SAA-C03 Deep Dive: Designing Secure and Resilient AWS Architectures (Domains 1 & 2)

Domains 1 and 2 of the AWS Solutions Architect Associate (SAA-C03) represent 56% of the exam: Design Secure Architectures (30%) and Design Resilient Architectures (26%). These are not surface-level questions — they present complex multi-service scenarios and require you to choose the architecture that best balances security, resilience, and operational simplicity.

This deep dive covers every concept, service comparison, and architecture pattern you need to answer these questions with confidence. We include decision tables, text-based architecture diagrams, and CloudFormation snippets that reinforce how services connect in real exam scenarios.

Domain 1: Design Secure Architectures (30%)

IAM Roles vs Policies vs Permission Boundaries

The SAA-C03 expects you to distinguish between different IAM mechanisms and know when each is appropriate:

S3 Security Patterns

S3 security questions are among the most common on the SAA-C03. You need to understand multiple layers of access control:

VPC Security: Security Groups vs NACLs

KMS Encryption Patterns

KMS questions test your understanding of key types and envelope encryption:

• AWS Managed Keys (aws/service): Created and managed by AWS. Automatic rotation every year. Cannot control key policy. Free to use.
• Customer Managed Keys (CMK): You create, manage, and control the key policy. Can enable/disable rotation. Can grant cross-account access. $1/month + API usage charges.
• Envelope Encryption: KMS generates a data key. The data key encrypts your data. KMS encrypts the data key with your CMK. You store the encrypted data key alongside the encrypted data. This allows encrypting data larger than 4 KB.

AWS Verified Access and Bedrock VPC Endpoint

AWS Verified Access provides secure access to corporate applications without a VPN. It uses trust providers (IAM Identity Center, third-party IdPs) to verify user identity and device posture before granting access. Use it when the exam asks about "zero-trust access to internal applications" or "replacing VPN for application access."

Amazon Bedrock VPC Endpoint: For private access to generative AI foundation models, create an Interface VPC Endpoint for Bedrock. This keeps traffic on the AWS network without traversing the internet — critical for regulated industries. If a question mentions "private access to foundation models" or "Bedrock without internet access," the answer involves a VPC Interface Endpoint (powered by AWS PrivateLink).

Domain 2: Design Resilient Architectures (26%)

Disaster Recovery Strategies

This is one of the most heavily tested topics. Memorize this table:

AWS Elastic Disaster Recovery (DRS): Provides continuous block-level replication of on-premises or cloud servers to AWS. Maintains a lightweight staging area and allows recovery within minutes. Use this when the question mentions "migrating disaster recovery to AWS" or "automated failover for on-premises servers."

Aurora Global Database vs DynamoDB Global Tables

S3 Multi-Region Access Points: Provide a single global endpoint that automatically routes S3 requests to the nearest replicated bucket. Combined with S3 Cross-Region Replication, this gives you active-active object storage across Regions. Use this when the exam asks about "global low-latency access to S3 data."

Route 53 Routing Policies

Capacity Blocks for ML

Capacity Blocks for ML let you reserve GPU instances (e.g., P5, P4d) for a defined period (typically days to weeks) for machine learning training jobs. Unlike standard Reserved Instances, Capacity Blocks guarantee capacity in a specific Availability Zone at a future date. Use this when the exam asks about "guaranteed GPU capacity for a training job" or "reserving compute for a time-bound ML workload."

CloudFormation Snippets

The SAA-C03 does not require you to write CloudFormation, but understanding these patterns reinforces how services connect:

VPC Endpoint for S3 (Gateway type):

Resources:
  S3GatewayEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref MyVPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref PrivateRouteTable

Interface VPC Endpoint for Bedrock:

Resources:
  BedrockEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref MyVPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.bedrock-runtime
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref EndpointSecurityGroup
      PrivateDnsEnabled: true

Aurora Global Database Cluster:

Resources:
  GlobalCluster:
    Type: AWS::RDS::GlobalCluster
    Properties:
      GlobalClusterIdentifier: my-global-cluster
      Engine: aurora-mysql
      EngineVersion: "8.0.mysql_aurora.3.04.0"
      StorageEncrypted: true

  PrimaryCluster:
    Type: AWS::RDS::DBCluster
    Properties:
      GlobalClusterIdentifier: !Ref GlobalCluster
      Engine: aurora-mysql
      MasterUsername: admin
      MasterUserPassword: !Ref DBPassword
      DBSubnetGroupName: !Ref DBSubnetGroup